Microsoft Patches Exploited Office Zero-Day Vulnerability

Microsoft released security updates on January 26, 2026, to address a zero-day vulnerability in its Office suite that has been actively exploited by attackers. The flaw, tracked as CVE-2026-21509, allows unauthorized users to bypass security features designed to protect against malicious content in documents.

The vulnerability stems from Microsoft Office's reliance on untrusted inputs during security decisions, enabling attackers to circumvent Object Linking and Embedding (OLE) mitigations. These protections guard against vulnerable Component Object Model (COM) and OLE controls that could otherwise expose users to harmful code. According to Microsoft's advisory, exploitation requires an attacker to deliver a malicious Office file and persuade the recipient to open it, typically through phishing or social engineering tactics. The company confirmed that the Preview Pane in Office applications cannot serve as an entry point for attacks.

Affected products include Microsoft Office 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise. Users of Office 2021 and later versions receive automatic protection through a server-side update, though they...